CVE-2017-18001: Critical severity trustwave secure web gateway vulnerability
Trustwave Secure Web Gateway (SWG) through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2017-18001?
CVE-2017-18001 is a vulnerability in Trustwave Secure Web Gateway (SWG) that allows remote attackers to gain unauthorized access to the device.
What is the severity of CVE-2017-18001?
CVE-2017-18001 has a severity rating of 9.8, which is considered critical.
How does CVE-2017-18001 work?
CVE-2017-18001 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, leading to remote root access.
How can I fix CVE-2017-18001?
To fix CVE-2017-18001, it is recommended to update Trustwave Secure Web Gateway (SWG) to version 11.8.0.28 or later.
Where can I find more information about CVE-2017-18001?
You can find more information about CVE-2017-18001 in the references provided: http://seclists.org/fulldisclosure/2017/Dec/88, https://blogs.securiteam.com/index.php/archives/3550, https://www.exploit-db.com/exploits/44047/